161-java-profiling-detect
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides scripts that perform extensive execution of system and Java development tools to monitor application performance.
- Evidence:
scripts/profile-java-process.shexecutesjpsto list processes,jcmdandjstatfor monitoring, andkillto terminate processes. - Evidence:
scripts/run-java-process-for-profiling.shinvokesmvnandjavawith specific diagnostic flags to prepare applications for profiling. - [PRIVILEGE_ESCALATION]: The skill involves modifying file permissions and suggests running with high privileges for specific platform features.
- Evidence: The workflow in
SKILL.mdrequires runningchmod +xon the setup scripts. - Evidence:
scripts/profile-java-process.shincludes checks for root privileges ($EUID -eq 0) and informs the user that elevated permissions are necessary for kernel-level profiling on Linux systems. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local system environment that could influence its execution flow.
- Ingestion points:
scripts/profile-java-process.shreads the output of thejps -lcommand to generate a list of target processes. - Boundary markers: The script does not use explicit boundary markers for the process list output.
- Capability inventory: The script can terminate processes (
kill), execute diagnostic commands (jcmd), and run the profiler binary (asprof). - Sanitization: The script uses an interactive selection menu that requires the user to manually select or confirm the target PID before any profiling or destructive action occurs.
Audit Metadata